Security researchers have identified a serious vulnerability within FreeIPA, a leading identity management system, that allows unauthorized clients to gain administrative credentials. Red Hat has confirmed and detailed the flaw, which involves creating a Kerberos identity without prior login, subsequently allowing access to administrative privileges.
Understanding the FreeIPA Flaw
FreeIPA, utilized to manage access across Linux domains, relies on a 389 Directory Server database. The vulnerability arises from a flaw in FreeIPA version 4.13.4, which has since been patched. This exploit requires a secondary weakness in the directory server’s software, specifically CVE-2026-76578, which Red Hat rates as critical with a CVSS score of 9.8.
Red Hat’s investigation reproduced the exploit on default installations, demonstrating the vulnerability’s severity. This security issue also affects their Identity Management product, known as ipa, which is shipped with FreeIPA.
Technical Details of the Exploit
The exploit leverages an access control rule in FreeIPA that allows users to manage their own one-time-password tokens without authentication. The associated flaw in the 389 Directory Server allows an anonymous client to create an identity with blank ownership fields, thereby bypassing authentication checks.
This issue is cataloged under CVE-2026-76560 and is rated at 7.5. While Red Hat Directory Server typically does not use such rules by default, FreeIPA’s default configuration does, enabling this exploit in untouched installations.
Additional FreeIPA Vulnerabilities
Alongside the primary vulnerability, Red Hat disclosed another flaw, CVE-2026-79678, unrelated to the main exploit chain but still significant. This flaw, scoring 8.1, involves the idp-add command, which improperly processes user-supplied inputs before performing necessary permission checks.
Although the vulnerability does not allow code execution, it could enable attackers to read server environment variables or exhaust server memory resources. The impact varies based on the installation method, notably affecting environments where passwords are stored as environment variables.
Mitigation and Future Actions
To mitigate these vulnerabilities, administrators are advised to apply patches released by FreeIPA and Red Hat promptly. Until patched versions are available, restricting access to LDAP services through network measures can alleviate the risk. For the idp-add flaw, no workaround exists, necessitating updates to the affected packages.
While Red Hat has provided guidance, questions remain regarding whether the current patches remove previously created unauthorized identities, leaving administrators to monitor for any anomalies in their systems. The absence of detection rules complicates efforts to identify potential breaches.
Overall, these vulnerabilities highlight the critical need for vigilant patch management and comprehensive security practices within Linux domains.
